What is the CVSS score of CVE-2026-57339?

CVE-2026-57339 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Business Directory CVE-2026-57339

EUVD-2026-40110 MEDIUM

Missing Authorization (CWE-862)

2026-06-29 Patchstack

GHSA-m542-2fpm-5vj8

Authentication Bypass Business Directory

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable, no authentication per PR:N, no complexity barriers; impact capped at limited integrity and availability with no confidentiality loss per description; unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:23 vuln.today

CVSS changed

Jun 29, 2026 - 15:22 NVD

6.6 (MEDIUM) 6.5 (MEDIUM)

DescriptionCVE.org

Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions.

AnalysisAI

Broken Access Control in the Business Directory WordPress plugin (versions 6.4.23 and below) permits unauthenticated remote attackers to perform unauthorized operations against directory data, yielding limited integrity and availability impacts. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no special configuration, and no user interaction, making the attack trivially accessible to any network-reachable actor. No public exploit code and no CISA KEV listing are confirmed at time of analysis, placing current real-world exploitation risk in the moderate range.

Technical ContextAI

The affected component is the Business Directory plugin for WordPress, developed by Strategy11 Team, identified by CPE cpe:2.3:a:strategy11_team:business_directory:*:*:*:*:*:*:*:*. This plugin enables WordPress site owners to publish searchable business or service listings. The root cause is CWE-862 (Missing Authorization): the plugin fails to enforce capability or permission checks on one or more endpoints - likely REST API routes or wp-admin AJAX handlers - before executing sensitive actions. This pattern is endemic in WordPress plugins where developers register action hooks or REST endpoints without pairing them with current_user_can() or equivalent authorization gating, allowing the server to process requests from any caller regardless of identity.

RemediationAI

Update the Business Directory plugin to a version beyond 6.4.23 by visiting the WordPress admin dashboard under Plugins > Updates or by referencing the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/business-directory-plugin/vulnerability/wordpress-business-directory-plugin-6-4-23-broken-access-control-vulnerability for the confirmed patched release version, which was not explicitly stated in the available data. If an immediate update cannot be applied, a Patchstack-compatible virtual patching rule (available to Patchstack subscribers) can block exploitation at the WAF layer without requiring plugin changes; note this does not remediate the underlying code flaw. Alternatively, restricting unauthenticated access to WordPress AJAX endpoints (admin-ajax.php) or REST API routes via web server ACLs is a partial compensating control, but may break legitimate unauthenticated directory browsing features - weigh the trade-off against the site's public access requirements.